6 ms·

A conspiracy theorist would say that it sounds like a hit piece, as if the Guardian has been nudged by some higher power to slander WhatsApp in an attempt to pu

A conspiracy theorist would say that it sounds like a hit piece, as if the Guardian has been nudged by some higher power to slander WhatsApp in an attempt to push their general readership to drop E2E encrypted messaging altogether, because the "more secure" options are too difficult or less popular. The Guardian in particular would be chosen because of its normally accurate and privacy-conscious coverage in the past; i.e. it has street cred among activists and others who wish to communicate securely and privately. A realist would, however, see this as a news outlet unable to own their mistake and instead doubling down as you said, in a failed attempt to save face. A journalist wrote this story seemingly by the seat of her pants, and her employer is on a noble if misguided campaign to defend her article. I'm taking the realist path on this one; I don't think there's any grand conspiracy behind their baffling decision to stand behind obviously shoddy reporting. The fact that so many top security researchers -- who certainly aren't going to be influenced by any particular government or corporate interest -- are calling for a retraction is all the assurance I need that the story is baseless and the Guardian is inexplicably enjoying the taste of shoe leather.

idlewords 10y ago
I take the realist path too, but if this kind of negligent disinformation succeeds, people who do want to discredit secure apps will notice and remember.
- ABCLAW 10y ago
  Maciej, I have tremendous respect for you. What follows is a long post, so please don't feel like I am beating up on you - I am responding to a few things in this thread. --- This wasn't negligent disinformation (post-revision of the usage of 'backdoor') on the part of the Guardian. The reaction to the information presented on the part of the public - to switch to SMS in significant numbers - was irrational. That said, there is a productive issue raised by the Guardian that has been smoked out into the open, namely the revelation of two contradictory assumptions underlying the decision, as discussed by Moxie in the previous HN thread, to defend against state level snooping. The rationale goes a bit like this: 1 - People change keys in the regular course of using Whatsapp. It therefore needs to accept that without impeding usability. 2 - Most users do not care about security enough to prefer one service to another for the Whatsapp market segment - Those users use Signal or other offerings. 3 - Whatsapp's lack of 'post consent' resending is intentional, and designed to prevent the server from knowing who is monitoring the status of their keys. 4 - As such, Whatsapp effectively defends against dragnet surveillance! As security minded individuals will note inappropriate key changes once a MITM attack begins, confer, and determine they have been compromised at scale. The key flaw here is that 2 and 3 mean that for targeted surveillance, powerful attackers are unlikely to be uncovered while exfiltrating specific communications, and likely don't see very much reputational or legal risk to potentially triggering a key change event. So people are vulnerable to feasible, targeted message exfiltration, contrary to what they may have believed when E2E was rolled out. That's newsworthy. The fact that the security community is striking back makes me feel like they are circling the wagons now that the Guardian has caught them with their pants down - They should have been the ones raising these issues and providing the appropriate framing to protect the public.
  - idlewords 10y ago
    The thing the Guardian did that was really unforgivably bad is not canvass expert opinion. They didn't even care that 'backdoor' has a specific technical meaning, they just stuck it in the headline and then edited it out after getting called out.
    - ABCLAW 10y ago
      I think this is a valid concern, but one that applies to most media. In my field, I often see pieces circulated which are incorrect with facts sourced from less precise colleagues of mine. I don't believe the piece was not 'newsworthy', though, and I believe the security industry's response should have been one of collaboration rather than admonition - it leaves a bad taste in my mouth to see an industry with a clear communication problem striking at their best potential ally. The Guardian are not the 'bad guys' for trying to inform us of a vulnerability.
      - morganvachon 10y ago
        > The Guardian are not the 'bad guys' for trying to inform us of a vulnerability. This is my ultimate takeaway as well; their intent was good, it was their implementation that fell short. I'm just really bothered that they are unwilling to own their mistake and retract the article, or at the very least allow a counter-editorial to be written and published by them.
        idlewords 10y ago
        They've offered to publish a counter-editorial. But that would just lead to a headline like "Experts Divided Over Critical WhatsApp Vulnerability". They need to retract.
- Natsu 10y ago
  Doesn't help that editorial standards in general have taken a nose dive lately, with people spreading random anonymous rumors as "news." The first thing I do when I read a story any more is look for what sources of information they draw upon and whether or not they can be corroborated by any means. If your list of sources is full of anonymous rumors and things that can't be fact checked, or other stories with poor sourcing, I ignore the entire article and its conclusions. It's an interesting exercise for how you consume news (and especially "news") and I recommend it to everyone. That's part of what makes reading purely technical discussions so much more enjoyable. We're not talking about random internet rumors, we talk about code and anyone with a compiler, debugger, etc. can verify things directly. There's much less room for BS, because someone can call you on it and prove you wrong in ways that everyone can verify independently.
OJFord 10y ago
But if you were such a person, would you really think "oh, well, then I'm better off using nothing at all because what I was using has a potential exploit"?
- tedunangst 10y ago
  Are you one of the 80% who don't want to eat food containing DNA?
lmm 10y ago
> so many top security researchers -- who certainly aren't going to be influenced by any particular government or corporate interest What makes you so sure? The Guardian is fundamentally devoted to reporting the truth even - especially - when it's hostile to the government - the organisation is structured deliberately to ensure its independence. Can the quoted experts say the same about their payroll?
nvarsj 10y ago
Just live in the UK a while, and you'll see it's completely normal. The Guardian has link-baity headlines all the time, that grossly exaggerate stories. Pretty much all newspapers in the U.K. do this, save for the BBC. If it wasn't for the Snowden reveals, I'd consider the Guardian just another junk partisan newspaper.

idlewords 10y ago

I take the realist path too, but if this kind of negligent disinformation succeeds, people who do want to discredit secure apps will notice and remember.

ABCLAW 10y ago
Maciej, I have tremendous respect for you. What follows is a long post, so please don't feel like I am beating up on you - I am responding to a few things in this thread. --- This wasn't negligent disinformation (post-revision of the usage of 'backdoor') on the part of the Guardian. The reaction to the information presented on the part of the public - to switch to SMS in significant numbers - was irrational. That said, there is a productive issue raised by the Guardian that has been smoked out into the open, namely the revelation of two contradictory assumptions underlying the decision, as discussed by Moxie in the previous HN thread, to defend against state level snooping. The rationale goes a bit like this: 1 - People change keys in the regular course of using Whatsapp. It therefore needs to accept that without impeding usability. 2 - Most users do not care about security enough to prefer one service to another for the Whatsapp market segment - Those users use Signal or other offerings. 3 - Whatsapp's lack of 'post consent' resending is intentional, and designed to prevent the server from knowing who is monitoring the status of their keys. 4 - As such, Whatsapp effectively defends against dragnet surveillance! As security minded individuals will note inappropriate key changes once a MITM attack begins, confer, and determine they have been compromised at scale. The key flaw here is that 2 and 3 mean that for targeted surveillance, powerful attackers are unlikely to be uncovered while exfiltrating specific communications, and likely don't see very much reputational or legal risk to potentially triggering a key change event. So people are vulnerable to feasible, targeted message exfiltration, contrary to what they may have believed when E2E was rolled out. That's newsworthy. The fact that the security community is striking back makes me feel like they are circling the wagons now that the Guardian has caught them with their pants down - They should have been the ones raising these issues and providing the appropriate framing to protect the public.
- idlewords 10y ago
  The thing the Guardian did that was really unforgivably bad is not canvass expert opinion. They didn't even care that 'backdoor' has a specific technical meaning, they just stuck it in the headline and then edited it out after getting called out.
  - ABCLAW 10y ago
    I think this is a valid concern, but one that applies to most media. In my field, I often see pieces circulated which are incorrect with facts sourced from less precise colleagues of mine. I don't believe the piece was not 'newsworthy', though, and I believe the security industry's response should have been one of collaboration rather than admonition - it leaves a bad taste in my mouth to see an industry with a clear communication problem striking at their best potential ally. The Guardian are not the 'bad guys' for trying to inform us of a vulnerability.
    - morganvachon 10y ago
      > The Guardian are not the 'bad guys' for trying to inform us of a vulnerability. This is my ultimate takeaway as well; their intent was good, it was their implementation that fell short. I'm just really bothered that they are unwilling to own their mistake and retract the article, or at the very least allow a counter-editorial to be written and published by them.
      - idlewords 10y ago
        They've offered to publish a counter-editorial. But that would just lead to a headline like "Experts Divided Over Critical WhatsApp Vulnerability". They need to retract.
Natsu 10y ago
Doesn't help that editorial standards in general have taken a nose dive lately, with people spreading random anonymous rumors as "news." The first thing I do when I read a story any more is look for what sources of information they draw upon and whether or not they can be corroborated by any means. If your list of sources is full of anonymous rumors and things that can't be fact checked, or other stories with poor sourcing, I ignore the entire article and its conclusions. It's an interesting exercise for how you consume news (and especially "news") and I recommend it to everyone. That's part of what makes reading purely technical discussions so much more enjoyable. We're not talking about random internet rumors, we talk about code and anyone with a compiler, debugger, etc. can verify things directly. There's much less room for BS, because someone can call you on it and prove you wrong in ways that everyone can verify independently.

OJFord 10y ago

But if you were such a person, would you really think "oh, well, then I'm better off using nothing at all because what I was using has a potential exploit"?

tedunangst 10y ago
Are you one of the 80% who don't want to eat food containing DNA?

lmm 10y ago

> so many top security researchers -- who certainly aren't going to be influenced by any particular government or corporate interest What makes you so sure? The Guardian is fundamentally devoted to reporting the truth even - especially - when it's hostile to the government - the organisation is structured deliberately to ensure its independence. Can the quoted experts say the same about their payroll?

nvarsj 10y ago

Just live in the UK a while, and you'll see it's completely normal. The Guardian has link-baity headlines all the time, that grossly exaggerate stories. Pretty much all newspapers in the U.K. do this, save for the BBC. If it wasn't for the Snowden reveals, I'd consider the Guardian just another junk partisan newspaper.